Researchers Demonstrate "Ghostcommit" Attack That Hides Prompt Injection in Images to Steal AI Agent Secrets
Security researchers from the University of Missouri-Kansas City's ASSET Research Group demonstrate a new attack called "Ghostcommit" that hides malicious instructions inside PNG images to bypass AI code reviewers and steal repository secrets. The technique exploits a significant review gap: a survey of 6,480 pull requests across the 300 most active public repositories finds that 73% of merged PRs reach the default branch with no substantive human or bot review at all.
The attack works by embedding prompt injection text inside an image file that an AGENTS.md coding-convention file references. Since AI code reviewers like CodeRabbit and Bugbot treat images as binary blobs and do not inspect their contents, the hidden malicious instructions go completely undetected. The researchers even stuff the PNG with explicit phrases like "malicious prompt injection" and direct orders to read environment files, and it still passes review without triggering any warnings.
The theft occurs later when a developer triggers the coding agent in an unrelated session, causing it to read the compromised AGENTS.md file, follow the pointer to the image, and silently exfiltrate secrets by encoding them as harmless-looking numeric constants in the source code. The researchers publish a proof-of-concept on GitHub and disclose their findings to affected vendors, highlighting an urgent need for tools that scrutinize image-based content consumed by AI coding agents.